Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c.

SunOS 5.10_x86: libsasl.so.1 patch.
Date this patch was last updated by Sun : Jul/24/09

SunOS 5.10: libsasl.so.1 patch.
Date this patch was last updated by Sun : Jul/24/09

The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2009-1116 advisory.

    [2.3.7-2.2]
    - add -fno-strict-aliasing to cflags

    [2.3.7-2.1]
    - fix sasl_encode64's buffers (#505427)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that the Cyrus SASL library (cyrus-sasl) does not always reliably terminate output from the sasl_encode64() function used by programs using this library. The Cyrus IMAP server (cyrus-imapd) relied on this function's output being properly terminated. Under certain conditions, improperly terminated output from sasl_encode64() could, potentially, cause cyrus-imapd to crash, disclose portions of its memory, or lead to SASL authentication failures. (CVE-2009-0688)

After installing the update, cyrus-imapd will be restarted automatically.

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2010-002 applied.

This security update contains fixes for the following products :

  - AppKit
  - Application Firewall
  - AFP Server
  - Apache
  - ClamAV
  - CoreTypes
  - CUPS
  - curl
  - Cyrus IMAP
  - Cyrus SASL
  - Disk Images
  - Directory Services
  - Event Monitor
  - FreeRADIUS
  - FTP Server
  - iChat Server
  - Image RAW
  - Libsystem
  - Mail
  - Mailman
  - OS Services
  - Password Server
  - perl
  - PHP
  - PS Normalizer
  - Ruby
  - Server Admin
  - SMB
  - Tomcat
  - unzip
  - vim
  - Wiki Server
  - X11
  - xar

Updated cyrus-imapd packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

The cyrus-imapd packages contain a high-performance mail server with IMAP, POP3, NNTP, and SIEVE support.

It was discovered that the Cyrus SASL library (cyrus-sasl) does not always reliably terminate output from the sasl_encode64() function used by programs using this library. The Cyrus IMAP server (cyrus-imapd) relied on this function's output being properly terminated. Under certain conditions, improperly terminated output from sasl_encode64() could, potentially, cause cyrus-imapd to crash, disclose portions of its memory, or lead to SASL authentication failures. (CVE-2009-0688)

Users of cyrus-imapd are advised to upgrade to these updated packages, which resolve this issue. After installing the update, cyrus-imapd will be restarted automatically.

This update of cyrus-sasl improves the output of function sasl_encode64() by appending a 0 for string termination. The impact depends on the application that uses sasl_encode64(). (CVE-2009-0688)

The remote host is affected by the vulnerability described in GLSA-200907-09 (Cyrus-SASL: Execution of arbitrary code)

    James Ralston reported that in certain situations, Cyrus-SASL does not     properly terminate strings which can result in buffer overflows when     performing Base64 encoding.
  Impact :

    A remote unauthenticated user might send specially crafted packets to a     daemon using Cyrus-SASL, possibly resulting in the execution of     arbitrary code with the privileges of the user running the daemon or a     Denial of Service.
  Workaround :

    There is no known workaround at this time.

James Ralston discovered that the Cyrus SASL base64 encoding function could be used unsafely. If a remote attacker sent a specially crafted request to a service that used SASL, it could lead to a loss of privacy, or crash the application, resulting in a denial of service.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

James Ralston discovered that the sasl_encode64() function of cyrus-sasl2, a free library implementing the Simple Authentication and Security Layer, suffers from a missing null termination in certain situations. This causes several buffer overflows in situations where cyrus-sasl2 itself requires the string to be null terminated which can lead to denial of service or arbitrary code execution.

Important notice (Quoting from US-CERT): While this patch will fix currently vulnerable code, it can cause non-vulnerable existing code to break. Here's a function prototype from include/saslutil.h to clarify my explanation :

/* base64 encode * in -- input data * inlen -- input data length * out
-- output buffer (will be NUL terminated) * outmax -- max size of output buffer * result: * outlen -- gets actual length of output buffer (optional) * * Returns SASL_OK on success, SASL_BUFOVER if result won't fit */ LIBSASL_API int sasl_encode64(const char *in, unsigned inlen, char *out, unsigned outmax, unsigned *outlen);

Assume a scenario where calling code has been written in such a way that it calculates the exact size required for base64 encoding in advance, then allocates a buffer of that exact size, passing a pointer to the buffer into sasl_encode64() as *out. As long as this code does not anticipate that the buffer is NUL-terminated (does not call any string-handling functions like strlen(), for example) the code will work and it will not be vulnerable.

Once this patch is applied, that same code will break because sasl_encode64() will begin to return SASL_BUFOVER.

Multiple buffer overflows in the CMU Cyrus SASL library before 2.1.23 might allow remote attackers to execute arbitrary code or cause a denial of service application crash) via strings that are used as input to the sasl_encode64 function in lib/saslutil.c (CVE-2009-0688).

The updated packages have been patched to prevent this.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

US-CERT reports :

The sasl_encode64() function converts a string into base64. The Cyrus SASL library contains buffer overflows that occur because of unsafe use of the sasl_encode64() function.

New cyrus-sasl packages are available for Slackware 10.2, 11.0, 12.0, 12.1, 12.2, and -current to fix a security issue. A buffer overflow in the sasl_encode64() function could lead to a denial of service or possible execution of arbitrary code.

ID	Name	Product	Family	Severity
108030	Solaris 10 (x86) : 141931-01	Nessus	Solaris Local Security Checks	high
107531	Solaris 10 (sparc) : 141930-01	Nessus	Solaris Local Security Checks	high
67877	Oracle Linux 5 : cyrus-imapd (ELSA-2009-1116)	Nessus	Oracle Linux Local Security Checks	critical
60601	Scientific Linux Security Update : cyrus-imapd on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
43759	CentOS 5 : cyrus-imapd (CESA-2009:1116)	Nessus	CentOS Local Security Checks	high
41499	SuSE 10 Security Update : cyrus-sasl (ZYPP Patch Number 6250)	Nessus	SuSE Local Security Checks	high
41381	SuSE 11 Security Update : cyrus-sasl (SAT Patch Number 881)	Nessus	SuSE Local Security Checks	high
41301	SuSE9 Security Update : cyrus-sasl (YOU Patch Number 12419)	Nessus	SuSE Local Security Checks	high
40209	openSUSE Security Update : cyrus-sasl (cyrus-sasl-880)	Nessus	SuSE Local Security Checks	high
39946	openSUSE Security Update : cyrus-sasl (cyrus-sasl-880)	Nessus	SuSE Local Security Checks	high
39780	GLSA-200907-09 : Cyrus-SASL: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	high
39515	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : cyrus-sasl2 vulnerability (USN-790-1)	Nessus	Ubuntu Local Security Checks	high
39461	RHEL 4 / 5 : cyrus-imapd (RHSA-2009:1116)	Nessus	Red Hat Local Security Checks	high
39332	Debian DSA-1807-1 : cyrus-sasl2, cyrus-sasl2-heimdal - buffer overflow	Nessus	Debian Local Security Checks	high
38946	openSUSE 10 Security Update : cyrus-sasl (cyrus-sasl-6249)	Nessus	SuSE Local Security Checks	high
38814	Mandriva Linux Security Advisory : cyrus-sasl (MDVSA-2009:113-1)	Nessus	Mandriva Local Security Checks	high
38779	FreeBSD : cyrus-sasl -- buffer overflow vulnerability (14ab174c-40ef-11de-9fd5-001bd3385381)	Nessus	FreeBSD Local Security Checks	high
38778	Slackware 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / current : cyrus-sasl (SSA:2009-134-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2009-0688

critical

Tenable Plugins

high

high

critical

high

critical

high

high

high

high

high

high

high

high

high

high

high

high

high

high